d361dd99bfa9c2b3af5dc7b448e061c791d4d4ec08d6937b67ec2da3644088a1 | Triage

Analysis

max time kernel
43s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
04-10-2022 06:22

Sharing

Report Analysis Logs

General

Target

d361dd99bfa9c2b3af5dc7b448e061c791d4d4ec08d6937b67ec2da3644088a1.dll
Size

3KB
MD5

32ac491bd4526c858c0d77e67facc639
SHA1

9413181085051c8dfe27bc1bbfcb7fee9d11cdfa
SHA256

d361dd99bfa9c2b3af5dc7b448e061c791d4d4ec08d6937b67ec2da3644088a1
SHA512

2653077a4cc3a168ba87b169e49380a22b67fee2d28bc89f8c13e649e57520d13f39b76c9edba2fff110ce4ae61dd82b5c2397a4f125dc608e0e334e4efba580

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 2028	1380	rundll32.exe	27
PID 1380 wrote to memory of 2028	1380	rundll32.exe	27
PID 1380 wrote to memory of 2028	1380	rundll32.exe	27
PID 1380 wrote to memory of 2028	1380	rundll32.exe	27
PID 1380 wrote to memory of 2028	1380	rundll32.exe	27
PID 1380 wrote to memory of 2028	1380	rundll32.exe	27
PID 1380 wrote to memory of 2028	1380	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d361dd99bfa9c2b3af5dc7b448e061c791d4d4ec08d6937b67ec2da3644088a1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d361dd99bfa9c2b3af5dc7b448e061c791d4d4ec08d6937b67ec2da3644088a1.dll,#1
  2⤵
  PID:2028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2028-54-0x0000000000000000-mapping.dmp

Download
memory/2028-55-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download